IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-24 14:17:41 -05:00
Code Issues Packages Projects Releases Wiki Activity
8,751 Commits 11 Branches 63 Tags
4ec8df27392b4f47c03c2cded26d6695d8c38186
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Basti 4ec8df2739 KRA: fix check that CA is installed 
https://fedorahosted.org/freeipa/ticket/5345

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-29 14:26:26 +01:00
Martin Basti beb6a3236d Domain levels: use constants rather than hardcoded values 
Added constants for domain levels
DOMAIN_LEVEL_0 = 0
DOMAIN_LEVEL_1 = 1

This allows to search for domain level easier in code.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-10-27 10:29:41 +01:00
Martin Basti 1195278f6b Remove executable bit from ipa_kra_install.py 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-10-26 18:08:27 +01:00
Martin Basti 288a9b9dba ipa-replica-manage: fix undefined variable 
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-23 13:02:14 +02:00
Martin Basti 92a4b18fc2 DNSSEC: warn user if DNSSEC key master is not installed 
Warning user that DNSSEC key master is not installed when commands
dnszone-add, dnszone-mod, dnszone-show when option dnssec=true

https://fedorahosted.org/freeipa/ticket/5290

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-10-22 18:29:44 +02:00
Martin Basti 179d86b5f6 DNSSEC: Remove service containers from LDAP after uninstalling 
The service containers are no needed there after uninstall anymore.
Removing these service also allows to detect if DNSSEC master is
installed on any replica for any user.

https://fedorahosted.org/freeipa/ticket/5290

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-10-22 18:29:44 +02:00
Martin Basti 2b01f71bef DNSSEC: store status of services only before first install 
DNS installer allows to reinstall DNS and DNSSEC, so the status of
services should be stored only for first time.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-10-22 18:26:59 +02:00
Martin Basti f2032ca2ca DNSSEC CI: wait until DS records is replicated 
In some cases replication may take much more time than we expected. This
patch adds explicit cech if DS records has been replicated.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-10-22 18:24:53 +02:00
Martin Basti f4c8c93e70 Rename option --dirsrv-config-mods to --dirsrv-config-file 
Option is renamed to be consistent with other options.

Affected tickets:
    https://fedorahosted.org/freeipa/ticket/4949
    https://fedorahosted.org/freeipa/ticket/4048
    https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-19 14:18:23 +02:00
Martin Basti 5233165ce7 CI: installation with customized DS config 
Test covers:

https://fedorahosted.org/freeipa/ticket/4949
https://fedorahosted.org/freeipa/ticket/4048
https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-15 18:37:52 +02:00
Martin Basti ae23432ef5 Add option to specify LDIF file that contains DS configuration changes 
This allows to user modify configuration changes of the directory server
instance during installation of DS

https://fedorahosted.org/freeipa/ticket/4949

Also fixes:
https://fedorahosted.org/freeipa/ticket/4048
https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-15 18:37:52 +02:00
Martin Basti 65c89cc711 Add method to read changes from LDIF 
modifications_from_ldif will read LDIF file and changes in LDIF will
be cached until parse() is called. After calling parse() method changes
will be applied into destination LDIF.

Only changetype modify is supported, the default operation is add.

https://fedorahosted.org/freeipa/ticket/4949

Also fixes:
https://fedorahosted.org/freeipa/ticket/4048
https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-15 18:37:52 +02:00
Martin Basti 63638ac9a3 Make offline LDIF modify more robust 
* move code to installutils
* add replace_value method
* use lists instead of single values for add_value, remove_value methods

https://fedorahosted.org/freeipa/ticket/4949

Also fixes:
https://fedorahosted.org/freeipa/ticket/4048
https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-15 18:37:52 +02:00
Martin Basti 16261adc58 Replace tab with space in test_user_plugin.py 
Mixing tabs and spaces is not allowed in python3

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-10-14 10:14:51 +02:00
Martin Basti 5f3784520b CI Test: add setup_kra options into install scripts 
https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Milan Kubik <mkubik@redhat.com>
 2015-10-12 17:50:22 +02:00
Martin Basti 573d3323af CI TEST: Vault 
Simple CI test for vault feature, including testing with replica

Covers https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Milan Kubik <mkubik@redhat.com>
 2015-10-12 15:15:23 +02:00
Martin Basti 74da4f5870 Replica inst. fix: do not require -r, -a, -p options in unattended mode 
Previous patches for this ticket introduced error, that replica install
requires to specify -r, -p and -a option in unattended mode.
This options are not needed on replica side.

https://fedorahosted.org/freeipa/ticket/4517

Reviewed-By: Milan Kubík <mkubik@redhat.com>
 2015-09-29 15:12:43 +02:00
Martin Basti 28c25241fe CI: backup and restore with KRA 
Reviewed-By: Milan Kubík <mkubik@redhat.com>
 2015-09-25 13:22:19 +02:00
Martin Basti e7713d45a4 Server Upgrade: addifnew should not create entry 
addifnew should add value only if entry exists, instead of creating
entry.

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-09-21 12:04:12 +02:00
Martin Basti a4b1bb25c9 Limit max age of replication changelog 
Limit max age of replication changelog to seven days, instead of grow to
unlimited size.

https://fedorahosted.org/freeipa/ticket/5086

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-09-21 12:04:12 +02:00
Martin Basti 8772fb4c3d backup CI: test DNS/DNSSEC after backup and restore 
Reviewed-By: Milan Kubík <mkubik@redhat.com>
 2015-09-16 18:20:18 +02:00
Martin Basti 3c33b48655 DNSSEC CI: test master migration 
Reviewed-By: Oleg Fayans <ofayans@redhat.com>
 2015-09-16 18:03:34 +02:00
Martin Basti f2b309ff4f DNSSEC: improve CI test 
Test disabling and re-enabling zone signing.

Reviewed-By: Oleg Fayans <ofayans@redhat.com>
 2015-09-16 18:03:34 +02:00
Martin Basti 7f0076b9a5 Server Install: print message that client is being installed 
IPA client is installed on server side during "Restarting web server"
step, which lasts too long. This commit explicitly print message that
IPA client is being installed.

Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-09-11 16:05:56 +02:00
Martin Basti f8f5bd644a IPA Restore: allows to specify files that should be removed 
Some files/directories should be removed before backup files are copied
to filesystem.

In case of DNSSEC, the /var/lib/ipa/dnssec/tokens directory has to be
removed, otherwise tokens that are backed up and existing tokens will be
mixed and SOFTHSM log in will not work

https://fedorahosted.org/freeipa/ticket/5293

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-09-11 14:57:58 +02:00
Martin Basti 5762ad951f Server Upgrade: backup CS.cfg when dogtag is turned off 
Is unable to made CS.cfg when dogtag is running.

https://fedorahosted.org/freeipa/ticket/5287

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-09-11 13:54:25 +02:00
Martin Basti 9ffe7f4998 FIX vault tests 
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-09-09 14:27:56 +02:00
Martin Basti e7a876d88a DNSSEC: remove ccache and keytab of ipa-ods-exporter 
Reusing old ccache after reinstall causes authentication error. And
prevents DNSSEC from working.

Related to ticket: https://fedorahosted.org/freeipa/ticket/5273

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-09-03 18:15:58 +02:00
Martin Basti b6435f2cc6 DNSSEC: backup and restore opendnssec zone list file 
When zone list is not restored after unninstall, this may slow down
enbaling DNSSEC signing for zones and print unwanted
errors into log after new installation.

Related to: https://fedorahosted.org/freeipa/ticket/5273

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-09-03 18:15:58 +02:00
Martin Basti 0bcf0c1be9 Installer: do not modify /etc/hosts before user agreement 
https://fedorahosted.org/freeipa/ticket/4561

As side effect this also fixes:
https://fedorahosted.org/freeipa/ticket/5266

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-09-03 16:01:30 +02:00
Martin Basti 0c5e41cc79 Server Upgrade: fix traceback caused by cidict 
Traceback caused by recent py3 code migration.

https://fedorahosted.org/freeipa/ticket/5283

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-09-03 14:11:52 +02:00
Martin Basti 7b3bd4e85d Backup: back up the hosts file 
https://fedorahosted.org/freeipa/ticket/5275

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-09-02 13:21:02 +02:00
Martin Basti 740f7fd817 DNSSEC: remove "DNSSEC is experimental" warnings 
https://fedorahosted.org/freeipa/ticket/5265

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-09-02 10:26:14 +02:00
Martin Basti 14a87632e5 Fix: Remove leftover krbV reference 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-26 12:53:12 +02:00
Martin Basti b4daa45baa DNSSEC: fix forward zone forwarders checks 
https://fedorahosted.org/freeipa/ticket/5179

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-08-25 17:37:44 +02:00
Martin Basti fb98e77104 Add user-stage command 
This patch replaces 'stageuser-add --from-delete' with new command
user-stage.

Original way always required  to specify first and last name, and
overall combination of options was hard to manage. The new command
requires only login of deleted user (user-del --preserve).

https://fedorahosted.org/freeipa/ticket/5041

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-21 12:29:03 +02:00
Martin Basti 556e97bf23 Server Upgrade: Start DS before CA is started. 
https://fedorahosted.org/freeipa/ticket/5232

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-19 11:55:21 +02:00
Martin Basti 9fe67dcf2b Add dependency to SSSD 1.13.1 
SSSD 1.13.1 has required functionality tu support duslstack and
multihomed

https://fedorahosted.org/freeipa/ticket/4249

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-19 11:03:58 +02:00
Martin Basti d7be2fd1bd Fix upgrade of sidgen and extdom plugins 
If configuration entries already exist, upgrade will not add them
again.

https://fedorahosted.org/freeipa/ticket/5151

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-08-10 15:03:54 +02:00
Martin Basti cea52ce186 ULC: Fix stageused-add --from-delete command 
Nonexistent method was used to move deleted user to staged area.
Minor fixes added:
 * handle not found error
 * return new DN

https://fedorahosted.org/freeipa/ticket/5145

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-29 17:06:54 +02:00
Martin Basti 45c709112d Use 'mv -Z' in specfile to restore SELinux context 
There might be AVC denial between moving file and restoring context.
Using 'mv -Z' will solve this issue.

https://fedorahosted.org/freeipa/ticket/4923

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-29 16:44:13 +02:00
Martin Basti 2427b2c242 Remove ico files from Makefile 
Icons were removed in a4be844809 but still
persist in Makefile. This patch fixes Makefile.

https://fedorahosted.org/freeipa/ticket/823

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-27 16:19:49 +02:00
Martin Basti 92828d3cf5 DNS: check if DNS package is installed 
Instead of separate checking of DNS required packages, we need just
check if IPA DNS package is installed.

https://fedorahosted.org/freeipa/ticket/4058

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-21 17:30:10 +02:00
Martin Basti 5ea41abe98 DNS: Consolidate DNS RR types in API and schema 
* Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API:
    These records never worked, they dont have attributes in schema.
    TSIG and TKEY are meta-RR should not be in LDAP
    TA is not supported by BIND
    NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be
    in LDAP.
    *! SIG, NSEC are already defined in schema, must stay in API.

* Add HINFO, MINFO, MD, NXT records to API as unsupported records
    These records are already defined in LDAP schema

* Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records
    These records were defined in IPA API as unsupported, but schema definition was
    missing. This causes that ACI cannot be created for these records
    and dnszone-find failed. (#5055)

https://fedorahosted.org/freeipa/ticket/4934
https://fedorahosted.org/freeipa/ticket/5055

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-21 17:18:29 +02:00
Martin Basti c6c84faecf Py3: replace tab with space 
python3 does not allow to mix spaces and tabs

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2015-07-17 17:19:51 +02:00
Martin Basti 82aaa1e6d0 Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand 
--force option set replica-certify-all to 'no' during abort-clean-ruv
subcommand

https://fedorahosted.org/freeipa/ticket/4988

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-07-17 16:47:18 +02:00
Martin Basti 9f70128353 sysrestore: copy files instead of moving them to avoind SELinux issues 
Copying files restores SELinux context.

https://fedorahosted.org/freeipa/ticket/4923

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-07-17 13:46:23 +02:00
Martin Basti a619a1e211 Validate adding privilege to a permission 
Adding priviledge to a permission via webUI allowed to avoid check and to add permission
with improper type.

https://fedorahosted.org/freeipa/ticket/5075

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-17 04:57:54 +00:00
Martin Basti a0ce9e6b09 fix selinuxusermap search for non-admin users 
Remove nonexistent attribute 'hostmembergroup' that is not in ACI nor schema.

Related to https://fedorahosted.org/freeipa/ticket/5130

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-07-16 15:38:47 +02:00
Martin Basti 8bc0e9693b copy-schema-to-ca: allow to overwrite schema files 
If content of source and target file differs, the script will ask user
for permission to overwrite target file.

https://fedorahosted.org/freeipa/ticket/5034

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-15 07:11:21 +00:00
Martin Basti c144ea6fef Stageusedr-activate: show username instead of DN 
If activate user already exists, show name of this user in error message
instead of user DN.
Error message reworder to keep the same format as stageuser-add,
user-add.

https://fedorahosted.org/freeipa/ticket/5038

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-15 07:08:02 +00:00
Martin Basti 67b2b34085 Prevent to rename certprofile profile id 
https://fedorahosted.org/freeipa/ticket/5074

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-10 09:01:05 +00:00
Martin Basti e51bb1bc66 Fix logging in API 
Setup log in API before first usage

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-08 17:11:23 +02:00
Martin Basti 21b04769b9 Upgrade: Do not show upgrade failed message when IPA is not installed 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-08 12:58:50 +00:00
Martin Basti 1d9bdb2409 Fix regression: ipa-dns-install will add CA records if required 
https://fedorahosted.org/freeipa/ticket/5101

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-08 00:32:05 +02:00
Martin Basti 6fa123447f FIX: Clear SSSD caches when uninstalling the client 
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-07-07 16:27:24 +02:00
Martin Basti f7c98c650a Allow to run subprocess with suplementary groups 
Param suplementary_groups allows to specify list of group names to be
used for subprocess.
suplementary_groups param requires runas param to be specified.

Required for ticket: https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-07 08:37:15 +02:00
Martin Basti 2e4e8d759d DNSSEC: update message 
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-07 08:37:15 +02:00
Martin Basti e151492560 DNSSEC: allow to disable/replace DNSSEC key master 
This commit allows to replace or disable DNSSEC key master

Replacing DNSSEC master requires to copy kasp.db file manually by user

ipa-dns-install:
--disable-dnssec-master  DNSSEC master will be disabled
--dnssec-master --kasp-db=FILE  This configure new DNSSEC master server,  kasp.db from old server is required for sucessful replacement
--force Skip checks

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-07 08:37:15 +02:00
Martin Basti 884afb5d38 Server Upgrade: use debug log level for upgrade instead of info 
Upgrade contains too many unnecessary info logs.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-03 07:47:59 +00:00
Martin Basti 2e329ecdc7 KRA Install: check replica file if contains req. certificates 
https://fedorahosted.org/freeipa/ticket/5059

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-02 10:59:53 +00:00
Martin Basti 96c23659fc DNS: Do not traceback if DNS is not installed 
Instead of internal error show 'DNS is not configured' message, when a
dns* command is executed.

https://fedorahosted.org/freeipa/ticket/5017

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-01 20:19:01 +02:00
Martin Basti b2f0a018b6 Sanitize CA replica install 
Check if cafile exist first.

https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-06-30 13:41:00 +02:00
Martin Basti 16f47ed452 Fix indicies ntUserDomainId, ntUniqueId 
ntUserDomainId and ntUniqueId  contained "eq,pres" index value, which is
not valid.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-29 13:40:29 +02:00
Martin Basti 20ffd4b614 Server Upgrade: create default config for NIS Server plugin 
Plugin is disabled by default.

This commit prevents false positive upgrade errors.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-18 17:48:36 +02:00
Martin Basti d2d13826c6 ipa-ca-install fix: reconnect ldap2 after DS restart 
https://fedorahosted.org/freeipa/ticket/5064

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-18 17:46:52 +02:00
Martin Basti 3ababb763b DNS: add UnknownRecord to schema 
defintion of UnknownRecord attributetype

https://fedorahosted.org/freeipa/ticket/4939

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-18 14:37:28 +02:00
Martin Basti c1d484afde Server Upgrade: disconnect ldap2 connection before DS restart 
Without this patch, the invalid api.Backend.ldap2 connection
was used to communicate with DS and it raises network error
after DS restart.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-15 09:54:04 +02:00
Martin Basti f763b137ee DNSSEC: fix traceback during shutdown phase 
ipa-dnskeysyncd causes traceback when receive SIGTERM, SIGINT

Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-15 09:43:51 +02:00
Martin Basti 6a92b32bf2 Revert 389-DS BuildRequires version to 1.3.3.9 
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
 2015-06-11 13:21:27 +02:00
Martin Basti f8c8c360f1 DNSSEC: validate forward zone forwarders 
Show warning messages if DNSSEC validation is failing for particular FW
zone or if the specified forwarders do not work

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-11 13:12:31 +02:00
Martin Basti 9aa6124b39 DNSSEC: Improve global forwarders validation 
Validation now provides more detailed information and less false
positives failures.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-11 13:12:31 +02:00
Martin Basti b6924c00ab Fix: regression in host and service plugin 
Test failures:
 * wrong error message
 * mod operation always delete usercertificates

https://fedorahosted.org/freeipa/ticket/4238

Reviewed-By: Milan Kubik <mkubik@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-06-03 17:52:30 +00:00
Martin Basti 943c539122 ULC: fix: upgrade for stage Stage User Admins failed 
Upgrade failed because entry 'dn: cn=Stage User
Administrators,cn=privileges,cn=pbac,$SUFFIX' doesnt exist.

Now upgrade will create the privilege if it does not exist.

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-06-02 13:50:19 +00:00
Martin Basti af8f44c86a Installers fix: remove temporal ccache 
Environ variable may be changed outside, so store path into global
variable.

https://fedorahosted.org/freeipa/ticket/5042

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-06-02 10:35:22 +00:00
Martin Basti 9eedffdfa6 Server Upgrade: fix remove statement 
If value does not exists then do not update entry. Otherwise, together with
nonexistent entry, the LDAP decode error will be raised.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-26 11:33:07 +00:00
Martin Basti f903c2d5bf Fix: use DS socket check only for upgrade 
To detect if DS server is running, use the slapd socket for upgrade, and the LDAP port
for installation.

Without enabled LDAPi socket checking doesnt work.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-05-26 11:30:15 +00:00
Martin Basti 027515230a Server Upgrade: Move code from ipa-upgradeconfig to separate module 
This also prevent the script ipa-upgradeconfig execute upgrading.
Upgrade of services is called from ipa-server-upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-25 16:34:44 +00:00
Martin Basti c43c5d1e43 Server Upgrade: Fix: execute schema update 
Accidentaly schema upgrade has not been executed.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-05-22 15:56:33 +02:00
Martin Basti 3d17bf8e63 Server Upgrade: wait until DS is ready 
During server upgrade we should wait until DS is ready after restart, otherwise
connection error is raised.

Instead of 389 port, the DS socket is checked.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-05-22 15:51:05 +02:00
Martin Basti 98e4c6d6de Uid uniqueness: fix: exclude compat tree from uniqueness 
Without this commit it is not possible to move user to staged area.

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2015-05-22 15:41:41 +02:00
Martin Basti ab69a0b1a7 Pylint: fix false positive warning for domain 
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-05-19 19:14:58 +02:00
Martin Basti ae9c3e2dce DNS install: extract DNS installer into one module 
This is required modification to be able move to new installers.

DNS subsystem will be installed by functions in this module in each of
ipa-server-install, ipa-dns-install, ipa-replica-install install
scripts.

https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-19 14:21:31 +00:00
Martin Basti 96f6d6ca09 DNSSEC: update OpenDNSSEC KASP configuration 
* remove unneeded parts
* increase KSK key length to 3072
* increase KSK key lifetime to 2 years (see NIST SP 800-81-2 section 11.2)

Update is not required, as template contains just recommended values
which should by reviewed by administrators.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-05-19 12:50:56 +00:00
Martin Basti ebd9146113 DNSSEC: FIX Do not re-create kasp.db if already exists 
Kasp should not be replaced by DNS reinstallation with new file.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-05-19 12:47:59 +00:00
Martin Basti fbdfd688b9 Server Upgrade: Fix uniqueness plugins 
Due previous changes (in master branch only) the uniqueness plugins
became misconfigured.

After this patch:
* whole $SUFFIX will be checked by unique plugins
* just staged users are exluded from check

This reverts some changes in commit
52b7101c11

Since 389-ds-base 1.3.4.a1 new attribute 'uniqueness-exclude-subtrees'
can be used.

https://fedorahosted.org/freeipa/ticket/4921

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-19 12:45:41 +00:00
Martin Basti 99c0b918a7 Server Upgrade: ipa-ldap-updater will not do overall upgrade 
ipa-ldap-updater is now just util which applies changes specified in update
files or schema files.

ipa-ldap-updater will not do overall server upgrade anymore, use
ipa-server-upgrade instead.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 78baeeb77c Server Upgrade: handle errors better 
* Prevent to continue with upgrade if a fatal error happened
* Use exceptions to handle failures

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti f6e3088b87 Server Upgrade: do not allow to run upgradeinstace alone 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 6c438fff33 Server Upgrade: raise RuntimeError instead exit() 
Ldapupdater should not call sys.exit() in the middle of execution and
should fail gracefully

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 7660f40e2b Server Upgrade: Do not start DS if it was stopped before upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 3c86b0ef3e Dont use the proxy to check CA status 
Checking status of the CA via proxy cause issues when httpd instance is
down.

To check status of CA we do not need proxy.

https://fedorahosted.org/freeipa/ticket/4994

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-15 10:22:28 +00:00
Martin Basti 57fba7a56f Server Upgrade: fix memberUid index 
https://fedorahosted.org/freeipa/ticket/5007

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-12 12:50:47 +02:00
Martin Basti 520bbd001b Server Upgrade: Allow base64 encoded values 
This patch allows to use base64 encoded values in update files.

Double colon ('::') must be used as separator between attribute name
and base64 encoded value.

add:attr::<base64-value>
replace:attr::<old-base64-value>::<new-base64-value>

https://fedorahosted.org/freeipa/ticket/4984

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-11 16:08:01 +00:00
Martin Basti 5783d0c832 Server Upgrade: remove CSV from upgrade files 
CSV values are not supported in upgrade files anymore

Instead of

   add:attribute: 'first, part', second

please use

  add:attribute: firts, part
  add:attribute: second

Required for ticket: https://fedorahosted.org/freeipa/ticket/4984

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-11 16:08:01 +00:00
Martin Basti 5db962d167 Server Upgrade: enable DS global lock during upgrade 
https://fedorahosted.org/freeipa/ticket/4925

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 882ce85ad5 Server Upgrade: use LDIF parser to modify DSE.ldif 
Ticket: https://fedorahosted.org/freeipa/ticket/4925
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 522cbb23f1 move realm_to_serverid to installutils module 
To avoid cyclic imports realm_to_serverid function had to be moved to
installutils from dsinstance.

Required for: https://fedorahosted.org/freeipa/ticket/4925

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 81df7b501e Server Upgrade: fix a comment in ldapupdater 
DN sorting was removed in previous patches

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-05 11:47:49 +02:00
Martin Basti 3debc7b2b5 Server Upgrade: use ipa-server-upgrade in RPM upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-04 11:16:26 +00:00